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Position-based quantum cryptography (PBQC) allows a party to use its geographical location 
as its only credential to implement various cryptographic protocols. Such a protocol may lead to 
important applications in practice. Although it has been shown that any PBQC protocol is breakable 
if the adversaries pre-share an arbitrarily large entangled state, the security of PBQC in the bounded- 
quantum-storage model is still an open question. In this paper, we study the performance of various 
PBQC protocols over a lossy channel under the assumption that no entanglement is pre-shared 
between adversaries. By introducing the decoy state idea, we show that an extended BB84-type 
PBQC protocol implemented with a weak coherent source and realistic single photon detectors can 
tolerate an overall loss (including both the channel loss and the detection efficiency) of 13 dB if the 
intrinsic quantum bit error rate is 1%. We also study a few continuous variable PBQC protocols 
and show that they suffer from a 3 dB loss limitation. 
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I. INTRODUCTION 

Quantum physics has been applied to enhance com¬ 
munication security. A well-known example is quantum 
key distribution (QKD) [IHI, which has been proved to 
be unconditionally secure in principle [^-Q. More re¬ 
cently, position-based quantum cryptography (PBQC) 
has drawn a lot of attention [Ml. 

In PBQC, a legitimate party uses its geographical lo¬ 
cation as its only credential to implement various cryp¬ 
tographic protocols. One fundamental task in PBQC is 
secure position verification, in which an honest prover 
tries to prove to a set of trusted verifiers that he/she is 
at a certain location. It has been shown that, given a 
secure position verification scheme, other position-based 
cryptographic tasks, such as authentication and key dis¬ 
tribution, can also be implemented [T^ . 

Although previous studies have shown that any PBQC 
protocols are breakable if the adversaries pre-share an ar¬ 
bitrarily large entangled state [3, the security of PBQC 
in the bounded-quantum-storage model, which is more 
relevant in practice, is still an open question. In [T3| . 
the security of PBQC has been proved based on the as¬ 
sumption that no entanglement is pre-shared between 
adversaries. In [l5l |. the authors proposed a one-round 
quantum position verification scheme and proved its se¬ 
curity against adversaries with an amount of pre-shared 
entanglement that is linear in the number of qubits trans¬ 
mitted. In contrast, all classical position-based crypto¬ 
graphic protocols are breakable without using pre-shared 
entanglement [l^. This highlights the advantage of 
PBQC over its classical counterpart. 
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One important issue in PBQC which has not been care¬ 
fully addressed is its tolerance to the loss of the quantum 
communication channel. In most of the previous studies, 
the BB84 encoding scheme has been adopted to imple¬ 
ment a PBQC protocol. It is easy to show (see Section ITTll 
that the above protocol is insecure as long as the overall 
loss is above 3 dB. In practice, the loss of the measure¬ 
ment device itself (including optical coupling loss and de¬ 
tector efficiency) is typically above 3 dB. This suggests 
the BB84-type PBQC protocols are impractical. 

In this paper, we explore PBQC protocols which can 
go beyond the above 3 dB limit. We study the perfor¬ 
mance of various PBQC protocols over a lossy channel 
under the assumption that no entanglement is pre-shared 
between adversaries. These PBQC protocls are derived 
naturally from the corresponding QKD schemes, includ¬ 
ing both discrete-variable (DV) and continuous-variable 
(CV) schemes. Our study shows that a DV PBQC pro¬ 
tocol, which was proposed in [iSlil , can tolerate an 
arbitrarily high loss in the noiseless case. By introducing 
the decoy state idea [a, the above protocol can toler¬ 
ate an overall loss of 13 dB at a quantum bit error rate 
(QBER) of 1%, even when implemented with a practical 
weak coherent source and realistic single photon detec¬ 
tors (SPDs). In contrast, all the CV PBQC protocols 
studied in this paper suffer from a 3 dB loss limitation, 
even by using arbitrarily squeezed states and noiseless 
detectors. 

This paper is organized as follows: in Section m we 
outline the basic procedures of a PBQC protocol and the 
main assumptions we adopt. In Section imi we study 
the performance of a DV PBQC protocol in both ideal 
and realistic scenarios. In Section IlYl we present our 
results of CV PBQC protocols. We conclude with a brief 
discussion in Section El 
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II. POSITION-BASED QUANTUM 
CRYPTOGRAPHY 

For simplicity, in this paper, we only consider the one¬ 
dimensional case with two verifiers, Vo and Vi, and a 
prover P in the middle. The verifiers wish to verify the 
position of P. Unfortunately, there are two adversaries, 
Eq (between Vo and P) and Ei (between Vi and P) who 
will try to fake P. 

We assume that Vq and Vi hold synchronized clocks 
and they also share a secure communication channel 
(which could be established by using QKD). Eq and Ei 
have full control of the communication channels (both 
quantum and classical) between Vo and P, as well as the 
one between Vi and P. Furthermore, they have perfect 
detectors (noiseless and lossless) and can perform any lo¬ 
cal operations allowed by quantum mechanics with arbi¬ 
trarily high precision. However, Eo and Ei do not share 
any entanglement. Note that in the above picture, the 
adversaries can completely hijack signals from P. So, we 
can simply ignore the existence of P in our discussion 
below. 

Most existing PBQC protocols are based on the BB84- 
type coding scheme. The basic procedure is summarized 
below: 

1. The verihers agree on random bits a:,0€{O,l}. Vq 
prepares a qubit in the state 

\^) = H<^\x) ( 1 ) 

where |0) and |1) are computational basis states, 
and is the Hadamard matrix. 

2. Vo sends |^) to P through a free-space quantum 
channel, and Vi sends 9 to P through a free-space 
classical channel. Vq and Vi coordinate their trans¬ 
mission time to make sure that \tjj) and 9 arrive at 
P at the same time. 

3. As soon as j'l/') and 9 arrive, P performs a measure¬ 
ment in the basis {E[^\0), and broadcasts 

the measurement result x' back to Vq and Vi im¬ 
mediately. 

4. If the verifiers receive x' at the time consistent with 
the position of P, and x' agrees with x, the location 
of P is accepted as authenticated. 

Intuitively, the security of the above protocol can be un¬ 
derstood from the quantum no-cloning theorem [l8l| : af¬ 
ter step 2, Eo can intercept {ip) and Ei can intercept 
9 before P receives them. However, without the other 
piece of information, neither of them can perform step 3. 
While El can keep one copy of the classical information 
9 and forward another copy to Eo, Eo cannot make per¬ 
fect copies of the quantum state l"^). If Eo keeps \ifj) in 
a quantum memory and performs the measurement after 
she receives 9 from Ei, it will be too late to report the 
measurement result back to Vi. On the other hand, if 


Eo forwards {ip) to Ei, who in turn performs the mea¬ 
surement, it will be too late to report the measurement 
result back to Vq. We remark that the above argument 
is fallacious if Eq and Ei pre-share entanglement, which 
allows them to perform quantum teleportation [l9j. In 
this paper, we will only consider the case of no pre-shared 
entanglement between adversaries. 

One major issue in practice is the low reporting rate 
expected from honest P. Due to the channel loss and 
the low efficiency of practical SPDs, most of the time, 
P will report a “no detection” event. The adversaries 
can take advantage of the low detection probability and 
fool the verifiers. More specifically, once Eo receives l"^), 
she randomly chooses one of the two bases and performs 
a measurement. Then she forwards a copy of her basis 
information and the measurement result to Ei. On the 
other hand, once Ei receives 9, she forwards a copy to 
Eo- If Eo happens to use the correct basis, Eo and Ei 
report the measurement result to Vq a-nd Vi , respectively. 
Otherwise, they claim no detection. Since there are only 
two possible bases in the above protocol, the adversaries 
can achieve a 50% reporting rate without introducing 
errors. This suggests that the above protocol is insecure 
as long as the overall loss is above 3 dB0. Considering the 
high coupling loss of a free-space communication channel 
and the low detection efficiency of a practical SPD, the 
above PBQC protocol may only work over a very short 
distance. To make PBQC useful in practice, we need 
protocols which can go beyond this 3 dB limit. In the rest 
of this paper, we study the performance of various PBQC 
protocols over a lossy channel under the assumption that 
no entanglement is pre-shared between adversaries. 

III. DISCRETE-VARIABLE PBQC PROTOCOL 

One approach to the development of a loss-tolerant 
PBQC protocol is to employ more than two encoding 
bases. Here we study the performance of a PBQC pro¬ 
tocol based on a natural extension of the BB84 coding 
scheme, where Vq employs K encoding bases uniformly 
distributed over the whole Bloch sphere. Compared to 
the original PBQC scheme, this protocol also has an en¬ 
hanced security |1^ . 

We first describe the procedure of the PBQC proto¬ 
col. For simplicity, we assume that K is large enough 
that the encoding bases can be treated as uniformly and 
continuously distributed over the Bloch sphere. 

1. The verifiers agree on a random bit x € {0,1} and 


^ The verifiers cannot distinguish between the channel loss and 
the detection loss in a PBQC protocol. So we use only one pa¬ 
rameter, the overall loss, to quantify the transmittance. In this 
paper, we also neglect imperfection in Vo’s source, which cannot 
be accessed by the adversaries, and can be well calibrated by the 
verifiers. 
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two continuous random numbers 6 £ [0,7r], (j) £ 

[ 0 , 2 ^). 

Vo prepares a qubit in the state 


where U{0, (p) 


\^p) = u{e,p)\x) 



( 2 ) 


2. Vb sends \'p) to P, and Vi sends 9 and cp to P. Vo 
and Vi coordinate their transmission times to make 
sure that Ipj), 9 and cp arrive at P at the same time. 


3. As soon as \^p), 9 and p arrive, P performs a mea¬ 
surement in the basis {U{6,p)\0),U{9,p)\l)}. If 
P detects a photon successfully, he broadcasts the 
measurement result x' back to Vq and Vi immedi¬ 
ately. Otherwise, he reports no detection. 


4. If the verifiers receive x' at a time inconsistent with 
the position of P, the protocol fails and will be 
terminated. 


5. Through an authenticated classical channel, Vq and 
Vi compare the reported measurement results re¬ 
ceived by them. If they receive different results, 
the protocol fails and will be terminated. 

6. Vb, Vi and P repeat the above procedures many 
times. They estimate the reporting rate and the 
QBER. For a given reporting rate, if the QBER is 
below certain predetermined value, the location of 
P is accepted as authenticated. 

As noted in [l3l| , noisy operation in the honest case do 
not produce inconsistent results between different veri¬ 
fiers. This is because the classical communication chan¬ 
nel used by P to broadcast the measurement results is 
virtually noiseless. By performing step 5, we can further 
limit the adversaries’ power. For example, one possible 
hacking strategy is as follows. As soon as Ei receives 9 
and p, she forwards a copy to Eq. As soon as Eq receives 
she applies an optimal cloning machine to generate 
two imperfect copies of the input quantum state, keeps 
one and sends the other one to Ei. Once Eq receives the 
basis information from Ei, she measures her copy and 
reports the measurement result to Vb. Similarly, Ei mea¬ 
sures her own copy and reports the measurement result 
to Vi. In general, such an attack will produce inconsis¬ 
tent results between Vb and Vi and thus can be detected 
in step 5. The same argument can also be applied in CV 
PBQC protocols based on coherent detection. 

Below, we will study the performance of the above pro¬ 
tocol implemented with either a perfect single photon 
source or a more practical weak coherent source. 


A. Single photon source 

We assume that Vb employs a perfect single photon 
source to implement the above PBQC protocol. If the 


PBQC system is noiseless, the verifiers expect a perfect 
correlation between the measurement result reported by 
the honest P and the information encoded by Vb. How¬ 
ever, if the overall transmittance of the quantum commu¬ 
nication system between Vb and P is then the verifiers 
expect a reporting rate of r]. 

Having no information about the basis, Eq will make 
a choice of basis {9e,Pe) for her measurement. To make 
the attack undetectable, Eq can randomly choose one of 
the above K bases. Eq will then measure the quantum 
state sent by Vb, and forward a copy of her basis informa¬ 
tion and the measurement result to Ei. If Eq happens to 
use the correct basis, Eq and Ei will report the measure¬ 
ment result to Vb and Vi correspondingly. Otherwise, 
they claim no detection. Obviously, the reporting rate R 
is given by 2/AT (the adversaries report the result of the 
measurement, it 9 = p = 0, and the opposite result, if 
9 = IT, p = 0). It R < r], Eve’s attack can be detected 
due to the abnormal reporting rate. As AT —>■ oo, the 
adversaries’ reporting rate i? —>■ 0, which suggests that 
the above protocol can tolerate arbitrarily high channel 
loss in the noiseless case. 

In practice, the quantum communication system be¬ 
tween Vb and P is noisy due to imperfect state prepara¬ 
tion, detector noise, etc. In this case, the expected QBER 
from the honest P will not be zero. The adversaries can 
take advantage of the non-zero QBER to further improve 
their attack. As long as the adversaries can produce the 
same reporting rate and the QBER expected from the 
honest P at a time consistent with the position of P, the 
security of the PBQC protocol is compromised. 

The hacking strategy is discussed in detail in the Ap¬ 
pendix in the case of a finite K. Here, we proceed with 
a description of the strategy in the large AT limit. 

As soon as Eq receives the quantum state |^), she 
measures it in a basis randomly chosen from the whole 
Bloch sphercH and forwards a copy of her basis infor¬ 
mation {9e,Pe) and the measurement result (x') to Pi. 
Since the K bases chosen by the verifiers are uniformly 
distributed, for simplicity, in our calculations we set 
9e = pE = 0, without loss of generality. The error 
probability of Pq’s measurement result is given by sin^ |, 
which is independent of p. The adversaries’ strategy is 
as follows: if 0 £ [0, ©o) (where ©o < 'e/2 is a constant 
predetermined by the adversaries), they will report x' to 
Vb (Hi); if 0 £ (tt — ©o,7r], they will flip the bit and re¬ 
port a;' -I- 1 (mod 2) to Vb (Hi); otherwise, they claim no 
detection. 

It is easy to show that the adversaries’ reporting rate 
is given by 


Ri 


/ sin 9d9 = 2 sin^ —- 

Jo 2 


(3) 


^ If Eq always chooses the same basis, the reporting probability 
will depend on Vo’s basis. This can be detected by the verifiers. 
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and the average QBER introduced by the above attack 
is given by 


1 /*©o a jD 

Qi = — sin^ - sm9d9 = —(4) 

itl Jq Z 4 

In the above equations, the subscript 1 indicates that a 
single photon source is applied. 

Eq. (|^ quantifies the relation between the maximum 
reporting rate Ri and the corresponding QBER Qi due 
to the attack. It also shows how much loss the PBQC 
protocol can tolerate given an intrinsic QBER. For ex¬ 
ample, if the intrinsic QBER of the legitimate quantum 
communication system is 1%, then the adversaries could 
reproduce the same QBER with a reporting rate of up 
to 4%. This reporting rate is consistent with the one ex¬ 
pected from a quantum channel with an overall loss of 14 
dB. This implies that given a 1% intrinsic QBER, this 
protocol is secure as long as the overall loss is below 14 
dB. In general, the lower the intrinsic QBER, the higher 
the tolerable loss. 

In the Appendix, we study the case of a finite number 
K of uniformly distributed bases and obtain the maxi¬ 
mum reporting rate for a given QBER. As we show there, 
the above results are recovered in the large K limit. The 
convergence is actually fast, indicating that for practical 
applications K need not be very large. 


B. Weak coherent source 

A high quality, efficient single photon source is not 
available in practice. In this subsection, we will study the 
performance of the above PBQC protocol implemented 
with a practical attenuated laser source. We assume that 
the global phase of each laser pulse has been random¬ 
ized properly, so we can model the source as a phase- 
randomized weak coherent state. 

The performance of the BB84 QKD protocol degrades 
significantly when implemented with a phase-randomized 
weak coherent state. This is mainly due to the photon 
number splitting (PNS) attack [2^: if the quantum sig¬ 
nal contains more than one photons, an eavesdropper can 
split out one photon, store it in a quantum memory, and 
perform a measurement when the basis information is 
available. One way to solve the above problem is to in¬ 
troduce the decoy state idea 0. As we will show below, 
the decoy state idea can also be applied in PBQC proto¬ 
cols. 

The photon number of a coherent state follows a Pois¬ 
son distribution: 


n 

Pn = (5) 

n! 

where /ii is the average photon number of the coherent 
state, which is determined by Vq- 

We assume that the quantum communication system 
between Vq and P is characterized by the following pa¬ 


rameters: rj - the overall transmittance; Yq - the dark- 
count probability of SPD; and Cdet “ the error probability 
due to misalignment. 

In normal conditions (no adversaries), the expected re¬ 
porting rate and QBER from the honest P are given, 
respectively, by na 


= Yo + l- 


yo + edet(l-e-’''^Q 
^ 


R 


(M1 


( 6 ) 


where we have assumed that the error rate of the dark 
count is 0.5. 

The adversaries’ hacking strategy is as follows. As soon 
as pQ receives the quantum state from Vq, she performs a 
quantum non-demolition measurement to determine the 
photon number n in Vq’s signal. Then there are three 
possibilities: 


("a^ If n = 0, Eq and Ei report no detection. 


(b) It n = 1, Eq and Ei perform the same attack as 
described in the previous subsection. 


(c) It n > 1, Eq can optimize her measurement strategy 
to gain maximum information about x. 0 


We define i?„ and Qn as the conditional reporting rate 
and QBER, respectively, given that Vb’s signal contains 
n photons. In the attack outlined above, Rq = Qq = 0, 
whereas for a given Qi, Ri is upper bounded by Eq. 0. 
In the case of n > 1, determining the optimal measure¬ 
ment strategy for Eq is a problem related to the prob¬ 
lem of optimal state estimation with post-measurement 
information . The latter is by itself an interesting re¬ 
search topic. Here we will simply assume that Rn = 1 
and Qn = 0 for n > I, which is the most favorable as¬ 
sumption for the adversaries, although a corresponding 
strategy may not exist. The overall reporting rate and 
QBER under the above assumptions are given by, respec¬ 
tively, 

OO 

^ = ^pe->^^Rl + !-(! + 

n—0 

_ ^n=0 ^nPnQn _ MlC Ri , , 

" EZoPnRu ~ 4R(mi) 


^ In the case of rx > 1, one may suggest the following attack: Eq 
keeps one photon in her quantum memory and forwards the rest 
to El. After receiving the basis information from Ei, Eq can 
measure her photon in the correct basis and report the mea¬ 
surement result to Vq. Similarly, Ei can measure the photons 
forwarded by Eq and report the measurement result to Vi. In 
the ideal case, the adversaries will not introduce errors. However, 
in practice, the quantum state prepared by Vq cannot be perfect 
(or Vq may intentionally introduce a small amount of noise). So 
the above attack will produce inconsistent results received by Vq 
and Vi, and thus can be detected in step 5 of the protocol. 
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where we used the relation Qi = i?i/4 (Eq. (jd])). 

Without using decoy states, and are the 

only parameters available to the verifiers. To make their 
attack undetectable, the adversaries need to match 
and with i?p and by adjusting Pi. We per¬ 
formed a numerical simulation using Eqs. m and © with 
the following system parameters: Yq = 10“^, Cdet = 0.01, 
and fii = 0.018 {fii has been optimized to maximize the 
tolerable overall loss). Our simulation shows that as long 
as the overall transmittance 77 < 0.07 (which corresponds 
to 11.5 dB loss), the above PBQC protocol is insecure. 
This shows that the performance of the PBQC imple¬ 
mented with a weak coherence source is worse than the 
one implemented with a perfect single photon source. 

The basic idea of the decoy-state protocol is quite 
simple. For each transmission, Vq randomly chooses 
a number from a predetermined set {/xi, 7 x 2 , ■ • ■, 
and sets the average photon number of the weak co¬ 
herent pulse to the corresponding value. At the end 
of the protocol, Vq can determine the reporting rate 
and QBER for each {i = 1,2...M) separately. Now 
the parameters available to the verifiers are in the set 

As M ^ 

00 , the verifiers can determine the reporting rate and 
QBER of the single-photon pulse, (Pi, Qi), precisely [II- 
This is equivalent to the case that Vo has a perfect single 
photon source. So, by introducing the decoy-state idea, 
in the asymptotic case (i.e., M —>■ 00 , and the finite-date- 
size effect can be ignored) the performance of PBQC im¬ 
plemented with a weak coherence source approaches to 
the one implemented with a perfect single-photon source. 

In practice, it is inefficient to use a large M. Here, we 
study the simplest case where M = 2. Similar to ®, the 
expected reporting rate and QBER when Vq chooses 7 x 2 
as the average photon number are given, respectively, by 


Pi^=^ = 




To + 1 - 

^To + edet(l - 


P 


(M2) 


( 8 ) 


Using ([S]) and dH) , we can determine a lower bound of the 
reporting rate of a single-photon pulse [ 2 l|: 


41 ) = ^ 

f^lfJ-2 - M 2 


Mi 

2 2 

itJ'l) n(Ml) Ml ^1 ~ ^2 


-2Q'-p>R 




(9) 


By using P^^^ as an estimation of Pi in Q, we can de¬ 
termine a lower bound of the QBER due to the attack: 


®, 0 , ®, ®, and with the following system 
parameters: Tq = 10“®, Cdet = 0.01, mi = 0.12, and 
M 2 = 0.1. Our simulation shows that as long as the over¬ 
all transmittance 77 > 0.05 (which corresponds to about 
13 dB loss), the above PBQC protocol is secure. This re¬ 
sult is comparable with the one based on a perfect single 
photon source. Furthermore, compared with the weak 
coherent state protocol without decoy states, the decoy 
state protocol allows Vo to use a relatively large average 
photon number, which is more efficient. 


IV. CONTINUOUS-VARIABLE PBQC 
PROTOCOLS 

Continuous-variable (CV) QKD protocols based on op¬ 
tical coherent detection (such as homodyne or heterodyne 
detection) have been demonstrated as useful solutions for 
secure key distribution (231 - 1?^ . While the SPD used in 
DV QKD may output a “no-detection” event, the homo¬ 
dyne (or heterodyne) detector used in CV QKD always 
yields a measurement result regardless of channel loss. 
This suggests the “post-selection” strategy discussed in 
the previous Section, where the adversaries report a mea¬ 
surement result only when they happen to use a “good” 
measurement basis, cannot be applied in CV PBQC pro¬ 
tocols based on coherent detection. Another distinct ad¬ 
vantage of the CV protocol is that the local oscillator 
(LO) employed in coherent detection acts as a “mode 
selector” which can suppress broadband noise photons 
effectively [ 2 ^. This feature is especially appealing in 
free-space quantum communication systems where the 
background noise due to ambient light is high. 

One of the most successful CV QKD protocols is the 
Gaussian-modulated-coherent-state (GMCS) QKD [^ . 
In this protocol, Alice draws two random numbers, xa 
and PA, from a set of Gaussian random numbers, and 
sends a coherent state \xa + Wa) to Bob. Bob ran¬ 
domly chooses to measure either the amplitude quadra¬ 
ture [qx) or the phase quadrature (gp) by performing 
an optical homodyne detection. Later on. Bob informs 
Alice of which quadrature he measured for each trans¬ 
mission, and then they can generate a secure key from 
the corresponding data. 

The above GMCS QKD protocol can be extended into 
a PBQC protocol as follows. Vo prepares and sends the 
coherent state \xA+ipjC) to P, while Vi sends P a random 
number 6 which is uniformly distributed in [ 0 , 7 r]. Once 
P receives the quantum state from Vq, he performs a 
homodyne detection along the phase 6, and reports back 
the measurement result of the quadrature 


^(Mi) ^ Mie 


( 10 ) 


To make their attack undetectable, the adversaries need 
to match and with R^p^^ and Q^p^\ respec¬ 

tively. We performed a numerical simulation using Eqs. 


qe = qx cos9 + qpsinO ( 11 ) 

If the verifiers receive the measurement results at a time 
consistent with the position of P, and the measurement 
noise is consistent with the one expected from the channel 
with a predetermined loss, the location of P is accepted 
as authenticated. 
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Unfortunately, it is easy to show that the above PBQC 
protocol is insecure as long as the overall loss is above 3 
dB. The hacking strategy is as follows. As soon as Eq 
receives the quantum state from Vb; she splits it into 
two parts (/ and II) using a 50:50 beam splitter. She 
then measures the amplitude quadrature of part / and 
the phase quadrature of part II, and forwards the mea¬ 
surement results, {qx,qp), to Ei. Once Eq receives the 
information of 0 forwarded by Ei, she calculates qg (Eq. 
(EH)), and reports it to Vq. Ei performs the same calcu¬ 
lation and reports the result to Vi. It is easy to verify 
that the noise due to this attack is equivalent to the one 
due to a channel with 3 dB loss. So the above attack will 
always succeed, as long as the overall loss is above 3 dB. 

Can we improve the performance of PBQC by using 
squeezed states? Suppose that Vq prepares a squeezed 
state with a randomly chosen squeezing angle d. By using 
an infinitely squeezed state, a quadrature measurement 
in any angle other than 0 will result in an arbitrarily large 
uncertainty. If Eq measures both the amplitude quadra¬ 
ture qx and the phase quadrature qp as described above, 
most likely, the uncertainties in both measurements are 
very high. Intuitively, this will result in a large uncer¬ 
tainty in Eq’s estimation of qg (Eq. EH)- H follows that 
the adversaries will not be able to reproduce the small 
measurement noise expected from the honest P, and thus 
they will be caught by the verifiers. However, as we will 
show below, the above intuition is wrong. The perfor¬ 
mance of the above coherent-state PBQC protocol is not 
improved by using squeezed states. Roughly speaking, 
this is due to the fact that the noises in qx and qp are 
correlated and can be canceled out when Eg estimates 
qe- 

The squeezed state PBQC protocol is summarized as 
follows. 

1. The verifiers agree on two random numbers 9 and a, 
with 0 uniformly distributed in [0,7r], and a drawn 
from a Gaussian distribution of mean 0 and vari¬ 
ance cr^. Vq prepares the squeezed coherent state 

\ij) = R{0)D{a)S{s)\O) (12) 

where R{0) = represents a rotation, D{a) = 

e“(“ represents a displacement, and S{s) = 
gf(a -a ) jg squeezing operator. We assume 
that Vq can generate a squeezed state with an ar¬ 
bitrarily large squeezing parameter s. Note that 
when s = 0, this protocol reduces to the coherent- 
state protocol. 

2. Vo sends \tj;) to P, and Vi sends 0 to P. Vq and Vi 
coordinate their transmission times to make sure 
that I'l/') and 0 arrive at P at the same time. 

3. When P receives |'0) and 0, he first applies R{—9), 
then he performs a homodyne detection to measure 
the quadrature qx , and immediately broadcasts the 
measurement result a' to Vq and Vi. 


4. If the verifiers receive a' at a time inconsistent with 
the position of P, the protocol fails and is termi¬ 
nated. 

5. Through an authenticated classical channel, Vg and 
Vi compare the reported measurement results re¬ 
ceived by them. If they receive different results, 
the protocol fails and is terminated. 

6. Vg, Vi, and P repeat the above steps many times. 
They estimate the conditional variance 



where rj is the overall transmittance of the quantum 
channel. 

If A is consistent with the value expected from a 
channel with an overall transmittance rj, the loca¬ 
tion of P is accepted as authenticated. 


In normal conditions (no adversaries), the expected con¬ 
ditional variance from the honest P is given by 

+ ^ <»> 


where the second term on the right-hand side represents 
the vacuum noise due to the channel loss (referred to the 
input of the channel). 

Again, the adversaries launch the attack described 
above by using a 50:50 beam splitter and homodyne de¬ 
tectors. Let us define the annihilation operators of the 
two input modes of the beam spliter as a and b, and the 
annihilation operators of the two output modes as c and 


d, respectively. They are related by c = 



b), and 


d= -^{a + b). 

Eg sends |'0) to mode a, the vacuum state to mode b, 
and measures qx of mode c and qp oi mode d, 


(c) _ C_ 


Ex = 


2 2y/2 


(a+ -k a - 6+ - b) 




After receiving information on 9 from Vi , the adversaries 
report a' = cos 9 + q^p^ sind). 

Using Eq. (fOl) and the following relations 


R){9)aR{0) = 

D\a)aD{a) = a + a , 

5 )^ (s)a5'(s) = a cosh s — sinhs , (16) 


it is straightforward to calculate the conditional variance 
due to the attack. 



-2s 


1 

4 


(17) 
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Comparing Eqs. o and (II3, it is easy to see that as 
long as the overall transmittance 77 < 0.5, we will have 
A^; < Ap, which means the adversaries can reproduce 
the noise variance expected from the honest P thus the 
PBQC protocol is not secure. It should be noted that 
this result is independent of the squeezing parameter s. 


V. DISCUSSION 


In principle, both the BB84 QKD and the GMCS 
QKD can tolerate arbitrarily high channel loss when im¬ 
plemented with perfect devices. This is because Alice 
and Bob share an authenticated classical channel, which 
allows them to perform either post-selection or reverse 
reconciliation. However, in PBQC, the verifers and the 
prover do not share an authenticated classical channel, so 
they cannot apply the post-selection or reverse reconcil¬ 
iation scheme. This could explain why PBQC protocols 
based on the BB84 or GMCS encoding schemes cannot 
go beyond the 3 dB loss limit. 

A natural way to go beyond the above 3 dB limit is to 
use multiple encoding bases. Our discussion showed that 
by introducing the decoy state idea, an extended BB84- 
type PBQC protocol implemented with a weak coherent 
source and realistic SPDs could tolerate a total loss of 13 
dB when the intrinsic QBER is 1%. Such a protocol could 
find real-life applications. To further extend its working 
distance, one could explore new encoding schemes using 
a large set of mutually unbiased bases such as the one 
employed in [^ . 

In the case of CV PBQC protocols based on coher¬ 
ent detection, we have been unable to find a good way 
to go beyond the 3 dB limit, even by using arbitrarily 
squeezed states and perfect homodyne detectors. This 
result could be understood from the point of view of a 
virtual entanglement model [30l| . In the squeezed state 
PBQC protocol discussed in Section lTVl Vq could prepare 
the quantum state {ip) from a two-mode squeezed vacuum 
(TMSV) by measuring a randomly chosen quadrature qe 
of mode I using a homodyne detector, and sends mode 
II to P. Later on, Eq measures both the A-quadrature 
and P-quadrature of mode II by performing a conjugate 
homodyne detection. Since measurements performed by 
Vo and Eq commute with each other, we can reverse the 
order without changing the measurement statistics. In 
this picture, Eq measures mode II first while projecting 
mode / onto a Gaussian-modulated coherent state. Then 
Vq measures its quadrature qe- As such, the squeezed- 
state protocol is equivalent to a coherent state protocol 
and suffers from the same limitations. Nevertheless, the 
limitation of CV PBQC protocol can be partially com¬ 
pensated by the relatively high efficiency of a practical 
homodyne detector. 



FIG. 1: (Color online) Reporting rate (Ri) vs. QBER 
(Qi) for finite number of bases with TV = 4 (triangles), 
TV = 8 (circles), and TV —>• 00 (solid line). 
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Appendix: Finite number of bases 


The PBQC with finite bases is summarized below: 

1. The verifiers agree on a random bit x € {0,1} 
and two random numbers 9 = 6m (where m = 
0,1,...,TV — 1), and (p. The latter is chosen as 
follows. Given m (i.e., for a fixed 6 = 6m)^ an inte¬ 
ger n £ {0,1,..., [2TVsin0m]} is chosen randomly. 
Then the verifiers set (p = (pm,n- The chosen values 
of the two angles are, respectively. 


TOTT 


nn 

TV sin 9m 


(A.l) 


For large TV, this is a uniform distribution over the 
Bloch sphere dividing its area into 





14^2] 

K = 

[jv(l + 2c<,t—)] 


TT 


square pixels each of side ^. 

Vq prepares a qubit in the state 
\P:) = U{9,p>)\x) 

where C/(0,<^) = 

should be noted that for 0 = O, all choices of (p 
correspond to the same basis, {|0), |1)}. 


J4> 


sm ^ 


(A.2) 

(A.3) 
. It 









2. Vb sends \'ijj) to P, and Vi sends 0 and cf) to P. Vb 
and Vi coordinate their transmission times to make 
sure that \il)), 9 and tp arrive at P at the same time. 

3. As soon as \^p), 9 and (p arrive, P performs a mea¬ 
surement in the basis {f/(0, (/))|0), (^)|1)}. If 

P detects a photon successfully, he broadcasts the 
measurement result x' back to Vb and Vi immedi¬ 
ately. Otherwise, he reports no detection. 

4. If the verifiers receive x' at a time inconsistent with 
the position of P, the protocol fails and is termi¬ 
nated. 

5. Through an authenticated classical channel, Vb and 
Vi compare the reported measurement results re¬ 
ceived by them. If they receive different results, 
the protocol fails and is terminated. 


The average QBER in the adversaries’ attack is 

Ql — 'y ^^ Pm,n : Pm,n — Pra^n) 

^ n,m 

In the above equations, the subscript 1 indicates that a 
single photon source is applied. 

Since the distribution given in (jA.l[) is uniform, the 
adversaries’ choice of angles {9e,(Pe) does not affect the 
performance of their strategy. They need to choose them 
randomly, in order for their attack not to be detected. 
However, for our calculations, we may choose 9e = 0, 
(pE = 0, without loss of generality. In this case, the 
probability of error becomes independent of p. It is given 
by 

{ SicL , {9ra7pm^ri) Sa 

COS , { 9 rmPm,ri) ^ (A. 8) 

0 ; {9rn-iPm.^n) ^ 


6. Vb, Vi and P repeat the above steps many times. 
They estimate the reporting rate and the QBER. 
Eor a given reporting rate, if the QBER is below 
a certain predetermined value, the location of P is 
accepted as authenticated. 

We assume that Vb employs a perfect single photon 
source to implement the above PBQC protocol. Eq in¬ 
tercepts {ip) and immediately performs a measurement 
{Ho,I — Ho}, where Hq projects onto the state 

\0e,(Pe) = cos ^|0) -k sin^|l) (A.4) 


Notice that si-n?^ < cos^ ^ for < f, whereas the 
opposite holds for dm > f • Moreover, sin^ | is mono- 
tonically increasing in the interval [0, ^). It follows that 
the best reporting strategy of the adversaries is to re¬ 
port all outcomes for m < TOoi and opposite outcomes 
for m > N — mo where toq < N/2. This leads to the 
optimal reporting rate 


Ri 


2 

m—0 


2(too + 1) 
K 


rngTr 

-|- 2 sin-sin 

2N 


{mo -I- l)7r 
2N 


(A.9) 


She then forwards the measurement outcome xe to Ei. 
At the same time, Ei intercepts Vb’s basis information 
(d, (/>) from Vi and forwards it to Eo- Then the adver¬ 
saries have three options (agreed upon from the outset): 

(a) Report xe {Eo to Vb and Ei to Vi), if {9,(j)) G Sa- 

(b) Report {xe + l)mod2, if (d, 0) G Sb- 


The minimum reporting rate is i?i = ■^, as expected 
(found by setting mg = 0), whereas the maximum re¬ 
porting rate i?i = 1 is obtained by setting mo ~ ^ • 

The corresponding QBER in this optimal strategy for 
the adversaries is 

2 f) 

Ql = ^ [1 -t- 27V sin dm] sin^ 


(c) Report no detection, if (d, </)) G Sc- 

where 5'a, Sb, Sc are disjoint sets forming a partition of 
the set of possible pairs {9m,(l>m,n} (or equivalently, the 
pixels on the Bloch sphere). 

The reporting rate is 


^ #(^aU5f,) ^ ^ _ #{Sc) 


K 


The probability of error is 


K 


(A.5) 


sin^ + sin^ 0 sin d^ , (d, (p) G Sa 

p{9,p) = ^ cos^ + cos^ bW>E sindsind_E , {9,p) G Sb 

0 , (d, p) G Sc 

(A.6) 


2r7T,Q + l 
4 


2N^ - 2 moTT - 2 (mo + l)7r 

TV 2N 2N 


jV • ( 2 mo + l)Tr 
2-k 2N 


mo 


4N^ mpir • (r7io-|-l)-n- 

■n- 2N 2N 


(A.IO) 


At the minimum reporting rate Ri = we obtain Qi = 
0, as expected. At the maximum reporting rate, Ri = 1, 
we obtain As N ^ oo, we recover our earlier 

results in the case of continuous distribution of bases. 
We obtain Ri fv 2 sin^ ^ which is in agreement with 
eq. (O with 00 = Morever, after some algebra, 

we obtain asymptotically, Qi ks jRi, in agreement with 
eq. 0. Results for TV = 4, 8 and TV —>■ oo are shown in 
figure [TJ The convergence to the limit of a continuous 
distribution is fast - even the case TV = 8 is practically 
indistinguishable from the limit TV —^ oo. 
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